检索结果-内蒙古大学图书馆

Stubbifier: debloating dynamic server-side javascript applications

EMPIRICAL SOFTWARE ENGINEERING 2022年第7期27卷 161-161页

作者： Turcotte, Alexi Arteca, Ellen Mishra, Ashish Alimadadi, Saba Tip, Frank Northeastern Univ Khoury Coll Comp Sci Boston MA 02115 USA Purdue Univ W Lafayette IN 47907 USA Simon Fraser Univ Comp Sci Vancouver BC Canada

javascript is an increasingly popular language for server-side development, thanks in part to the *** runtime environment and its vast ecosystem of modules. With the *** package manager npm, users are able to easily include external modules as dependencies in their projects. However, npm installs modules with all of their functionality, even if only a fraction is needed, which causes an undue increase in code size. Eliminating this unused functionality from distributions is desirable, but the sound analysis required to find unused code is difficult due to javascript's extreme dynamicity. We present a fully automatic technique that identifies unused code by constructing static or dynamic call graphs from the application's tests, and replacing code deemed unreachable with either file- or function-level stubs. Due to javascript's highly dynamic nature, call graph construction may suffer from unsoundness, i.e., code identified as unused may in fact be reachable. To handle such cases, if a stub is called, it will fetch and execute the original code on-demand to preserve the application's behavior. The technique also provides an optional guarded execution mode to guard application against injection vulnerabilities in untested code that resulted from stub expansion. This technique is implemented in an open source tool called Stubbifier, designed to help package developers to produce a minimal production distribution. Stubbifier supports the ECMAScript 2019 standard. In an empirical evaluation on 15 *** applications and 75 clients of these applications, Stubbifier reduced application size by 56% on average while incurring only minor performance overhead. The evaluation also shows that Stubbifier's guarded execution mode is capable of preventing several known injection vulnerabilities that are manifested in stubbed-out code. Finally, Stubbifier can work alongside bundlers, popular javascript tools for bundling an application with its dependencies. For the conside

关键词： Debloating Program analysis javascript Node js

来源：评论

学校读者我要写书评

暂无评论

JEST: N+1-version Differential Testing of Both javascript Engines and Specification 21

JEST: <i>N</i>+1-version Differential Testing of Both JavaSc...

引用

43rd IEEE/ACM International Conference on Software Engineering - Software Engineering in Practice (ICSE-SEIP) / 43rd ACM/IEEE International Conference on Software Engineering - New Ideas and Emerging Results (ICSE-NIER)

作者： Park, Jihyeok An, Seungmin Youn, Dongjun Kim, Gyeongwon Ryu, Sukyoung Korea Adv Inst Sci & Technol Sch Comp Daejeon South Korea

ISBN: (纸本)9780738113197

Modern programming follows the continuous integration (CI) and continuous deployment (CD) approach rather than the traditional waterfall model. Even the development of modern programming languages uses the CI/CD approach to swiftly provide new language features and to adapt to new development environments. Unlike in the conventional approach, in the modern CI/CD approach, a language specification is no more the oracle of the language semantics because both the specification and its implementations (interpreters or compilers) can co-evolve. In this setting, both the specification and implementations may have bugs, and guaranteeing their correctness is non-trivial. In this paper, we propose a novel N+1-version differential testing to resolve the problem. Unlike the traditional differential testing, our approach consists of three steps: 1) to automatically synthesize programs guided by the syntax and semantics from a given language specification, 2) to generate conformance tests by injecting assertions to the synthesized programs to check their final program states, 3) to detect bugs in the specification and implementations via executing the conformance tests on multiple implementations, and 4) to localize bugs on the specification using statistical information. We actualize our approach for the javascript programming language via JEST, which performs N+1-version differential testing for modern javascript engines and ECMAScript, the language specification describing the syntax and semantics of javascript in a natural language. We evaluated JEST with four javascript engines that support all modern javascript language features and the latest version of ECMAScript (ES11, 2020). JEST automatically synthesized 1,700 programs that covered 97.78% of syntax and 87.70% of semantics from ES11. Using the assertion-injected javascript programs, it detected 44 engine bugs in four different engines and 27 specification bugs in ES11.

关键词： javascript conformance test generation mechanized specification differential testing

来源：评论

学校读者我要写书评

暂无评论

Reuse Opportunities in javascript applications 47

Reuse Opportunities in JavaScript applications

引用

EUROMICRO Joint Conference of 47th Software Engineering and Advanced Applications Conference (SEAA) and 24th Digital Systems Design (DSD)

作者： Terzi, Anastasia Bibi, Stamatia Sarigiannidis, Panagiotis Univ Western Macedonia Dept Elect & Comp Engn Kozani Greece

ISBN: (纸本)9781665427050

javascript nowadays is among the most popular programming languages, used for developing web and IoT applications. Currently, the majority of javascript applications is reusing third-party components to acquire various functionalities. In this paper we isolate popular reused components and explore the type of functionality that is mostly being reused. Additionally, we examine whether the client applications adapt to the most recent versions of the reused components, and further study the reuse intensity of pairs of components that coexist in client applications. For this purpose, we performed a case study on 9389 components reused by 430 javascript applications hosted in GitHub. The results show that Compiler and Testing Frameworks are the most common types of functionality being reused, while the majority of client applications tend to adopt the recent versions of the reused components.

关键词： component javascript reuse reuse intensity

来源：评论

学校读者我要写书评

暂无评论

Accelerating javascript Static Analysis via Dynamic Shortcuts 2021

Accelerating JavaScript Static Analysis via Dynamic Shortcut...

引用

29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)

作者： Park, Joonyoung Park, Jihyeok Youn, Dongjun Ryu, Sukyoung Korea Adv Inst Sci & Technol Daejeon South Korea

ISBN: (纸本)9781450385626

javascript has become one of the most widely used programming languages for web development, server-side programming, and even micro-controllers for IoT. However, its extremely functional and dynamic features degrade the performance and precision of static analysis. Moreover, the variety of built-in functions and host environments requires excessive manual modeling of their behaviors. To alleviate these problems, researchers have proposed various ways to leverage dynamic analysis during javascript static analysis. However, they do not fully utilize the high performance of dynamic analysis and often sacrifice the soundness of static analysis. In this paper, we present dynamic shortcuts, a new technique to flexibly switch between abstract and concrete execution during javascript static analysis in a sound way. It can significantly improve the analysis performance and precision by using highly-optimized commercial javascript engines and lessen the modeling efforts for opaque code. We actualize the technique via SAFE(DS), an extended combination of SAFE and Jalangi, a static analyzer and a dynamic analyzer, respectively. We evaluated SAFE(DS) using 269 official tests of Lodash 4 library. Our experiment shows that SAFE(DS) is 7.81x faster than the baseline static analyzer, and it improves the precision to reduce failed assertions by 12.31% on average for 22 opaque functions.

关键词： javascript static analysis dynamic analysis dynamic shortcut sealed execution

来源：评论

学校读者我要写书评

暂无评论

Implementation and Feasibility Analysis of a javascript-based Gambling Tool Device for Online Decision Making Task under Risk in Psychological and Health Services Research

Implementation and Feasibility Analysis of a Javascript-base...

引用

15th International Conference on Health Informatics (HEALTHINF) held as part of 15th International Joint Conference on Biomedical Engineering Systems and Technologies (BIOSTEC)

作者： Franckenstein, Sherine Appelbaum, Sebastian Ostermann, Thomas Witten Herdecke Univ Fac Hlth Methods & Stat Psychol Witten Germany Univ Bamberg Trimberg Res Acad Bamberg Germany

ISBN: (纸本)9789897585524

Decision making is one of the most complex tasks in human behavior. In the past, researchers have tried to understand how humans make decisions by designing neuropsychological tests to assess reward related decision making by evaluating the preference for smaller but immediate rewards over larger but delayed rewards or by evaluating the tolerance of risk in favor of a desired reward. The latter are also known as gambling tasks. Today, information technology offers a variety of possibilities to investigate behaviour under risk. After a short introduction on gambling tasks and in particular the game of dice task, this article describes the development and implementation of a javascript-based gambling tool for online surveys based on a game of dice task. In a pilot feasibility study with 170 medical students, participants were randomly assigned to a "REAL condition", based on the probabilities of the chosen bet and a "FAKE condition" where participants lose all the time independently of the chosen bet. We were able to show that the software was well accepted with only 14.7% of drop outs. Moreover, we also found a difference between the FAKE and the REAL group: Participants in the FAKE condition in the mean steadily increased their stake while then control group quite early tended to run a safer strategy. This is also obvious when the overall stake mean is compared: While in the REAL condition the mean stake is 310.89 +/- 222.98 (sic). the FAKE condition has an overall mean of 390.38 +/- 296.50 (sic). In conclusion, this article clearly indicates how a javascript based gambling tool can be used for psychological online research.

关键词： Decision Making Online-surveys Game of Dice Task javascript

来源：评论

学校读者我要写书评

暂无评论

Generating Automatic Unit Tests of javascript Code from UML Class and Activity Diagrams 16

Generating Automatic Unit Tests of JavaScript Code from UML ...

引用

16th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE)

作者： Malanowska, Agnieszka Malkiewicz-Blotniak, Adrianna Warsaw Univ Technol Inst Comp Sci Nowowiejska 15-19 Warsaw Poland

ISBN: (纸本)9789897585081

As testing phase plays a significant role in the software lifecycle, all facilitations that can speed up and automate this process seem to be very useful. One of the biggest group of approaches covers automatic test generation. In this paper, we describe our solution for fully automated unit test generation from UML class and activity diagrams. We have adapted and completely redesigned two algorithms from the literature. The first of them tests conformance of types of attributes and method return values between the class diagram and class implementation. The second one serves as a basis for testing all paths of the activity diagram. As a result, we generate tests in dynamically typed language, javascript, in the format required by Jest testing framework. We have implemented this approach in the extensible UML2Test tool, a plug-in to StarUML modeling environment. The tool generates complete executable unit tests from the UML model, so it can be used in conjunction with the test-driven development methodology. Usefulness of our approach and tool was successfully verified on the exemplary system for recruitment support.

关键词： Automatic Test Generation Unit Tests javascript UML Class Diagram Activity Diagram Jest StarUML Test-driven Development

来源：评论

学校读者我要写书评

暂无评论

Automated Conformance Testing for javascript Engines via Deep Compiler Fuzzing 2021

Automated Conformance Testing for JavaScript Engines via Dee...

引用

42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI)

作者： Ye, Guixin Tang, Zhanyong Tan, Shin Hwei Huang, Songfang Fang, Dingyi Sun, Xiaoyang Bian, Lizhong Wang, Haibo Wang, Zheng Northwest Univ Xian Peoples R China Southern Univ Sci & Technol Shenzhen Peoples R China Alibaba DAMO Acad Beijing Peoples R China Univ Leeds Leeds W Yorkshire England Alipay Hangzhou Informat & Technol Co Ltd Hangzhou Peoples R China

ISBN: (纸本)9781450383912

javascript (JS) is a popular, platform-independent programming language. To ensure the interoperability of JS programs across different platforms, the implementation of a JS engine should conform to the ECMAScript standard. However, doing so is challenging as there are many subtle definitions of API behaviors, and the definitions keep evolving. We present Comfort, a new compiler fuzzing framework for detecting JS engine bugs and behaviors that deviate from the ECMAScript standard. COMFORT leverages the recent advance in deep learning-based language models to automatically generate JS test code. As a departure from prior fuzzers, COMFORT utilizes the well-structured ECMAScript specifications to automatically generate test data along with the test programs to expose bugs that could be overlooked by the developers or manually written test cases. COMFORT then applies differential testing methodologies on the generated test cases to expose standard conformance bugs. We apply COMFORT to ten mainstream JS engines. In 200 hours of automated concurrent testing runs, we discover bugs in all tested JS engines. We had identified 158 unique JS engine bugs, of which 129 have been verified, and 115 have already been fixed by the developers. Furthermore, 21 of the COMFORT-generated test cases have been added to Test262, the official ECMAScript conformance test suite.

关键词： javascript Conformance bugs Compiler fuzzing Differential testing Deep learning

来源：评论

学校读者我要写书评

暂无评论

Just-In-Time Defect Prediction on javascript Projects: A Replication Study

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2022年第4期31卷 76-76页

作者： Ni, Chao Xia, Xin Lo, David Yang, Xiaohu Hassan, Ahmed E. Zhejiang Univ Sch Software Technol Zheda Rd 38 West Lake Dist Hangzhou Zhejiang Peoples R China Huawei Software Engn Applicat Technol Lab Jianghong Rd 410 Hangzhou Zhejiang Peoples R China Singapore Management Univ 80 Stamford Rd Singapore Singapore Zhejiang Univ Coll Comp Sci & Technol Rd 38 West Lake Dist Hangzhou Zhejiang Peoples R China Queens Univ 25 Union St Kingston ON Canada

Change-level defect prediction is widely referred to as just-in-time (JIT) defect prediction since it identifies a defect-inducing change at the check-in time, and researchers have proposed many approaches based on the language-independent change-level features. These approaches can be divided into two types: supervised approaches and unsupervised approaches, and their effectiveness has been verified on Java or C++ projects. However, whether the language-independent change-level features can effectively identify the defects of javascript projects is still unknown. Additionally, many researches have confirmed that supervised approaches outperform unsupervised approaches on Java or C++ projects when considering inspection effort. However, whether supervised JIT defect prediction approaches can still perform best on javascript projects is still unknown. Lastly, prior proposed change-level features are programming languageindependent, whether programming language-specific change-level features can further improve the performance of JIT approaches on identifying defect-prone changes is also unknown. To address the aforementioned gap in knowledge, in this article, we collect and label the top-20 most starred javascript projects on GitHub. javascript is an extremely popular and widely used programming language in the industry. We propose five javascript-specific change-level features and conduct a large-scale empirical study (i.e., involving a total of 176,902 changes) and find that (1) supervised JIT defect prediction approaches (i.e., CBS+) still statistically significantly outperform unsupervised approaches on javascript projects when considering inspection effort;(2) javascript-specific change-level features can further improve the performance of approach built with language-independent features on identifying defect-prone changes;(3) the change-level features in the dimension of size (i.e., LT), diffusion (i.e., NF), and javascript-specific (i.e., SO and TC) are the m

关键词： Defect prediction just-in-time defect prediction empirical study javascript

来源：评论

学校读者我要写书评

暂无评论

Towards Understanding the Faults of javascript-Based Deep Learning Systems 22

Towards Understanding the Faults of JavaScript-Based Deep Le...

引用

Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering

作者： Lili Quan Qianyu Guo Xiaofei Xie Sen Chen Xiaohong Li Yang Liu Tianjin University China Zhongguancun Laboratory China Singapore Management University Singapore Nanyang Technological University Singapore

ISBN: (纸本)9781450394758

Quality assurance is of great importance for deep learning (DL) systems, especially when they are applied in safety-critical applications. While quality issues of native DL applications have been extensively analyzed, the issues of javascript-based DL applications have never been systematically studied. Compared with native DL applications, javascript-based DL applications can run on major browsers, making the platform- and device-independent. Specifically, the quality of javascript-based DL applications depends on the 3 parts: the application, the third-party DL library used and the underlying DL framework (e.g., ***), called javascript-based DL system. In this paper, we conduct the first empirical study on the quality issues of javascript-based DL systems. Specifically, we collect and analyze 700 real-world faults from relevant GitHub repositories, including the official *** repository, 13 third-party DL libraries, and 58 javascript-based DL applications. To better understand the characteristics of these faults, we manually analyze and construct taxonomies for the fault symptoms, root causes, and fix patterns, respectively. Moreover, we also study the fault distributions of symptoms and root causes, in terms of the different stages of the development lifecycle, the 3-level architecture in the DL system, and the 4 major components of *** framework. Based on the results, we suggest actionable implications and research avenues that can potentially facilitate the development, testing, and debugging of javascript-based DL systems.

关键词： Deep Learning javascript Faults TensorFlow.js

来源：评论

学校读者我要写书评

暂无评论

Looking for Criminal Intents in javascript Obfuscated Code

引用

Procedia Computer Science 2022年 207卷 867-876页

作者： Federico Cerutti Daniele Barattieri di San Pietro Francesco Gringoli Gianfranco Lamperti Department of Information Engineering University of Brescia 25123 Brescia Italy

The majority of websites incorporate javascript for client-side execution in a supposedly protected environment. Unfortunately, javascript has also proven to be a critical attack vector for both independent and state-sponsored groups of hackers. On the one hand, defenders need to analyze scripts to ensure that no threat is delivered and to respond to potential security incidents. On the other, attackers aim to obfuscate the source code in order to disorient the defenders or even to make code analysis practically impossible. Since code obfuscation may also be adopted by companies for legitimate intellectual-property protection, a dilemma remains on whether a script is harmless or malignant, if not criminal. To help analysts deal with such a dilemma, a methodology is proposed, called JACOB, which is based on five steps, namely: (1) source code parsing, (2) control flow graph recovery, (3) region identification, (4) code structuring, and (5) partial evaluation. These steps implement a sort of decompilation for control flow fattened code, which is progressively transformed into something that is close to the original javascript source, thereby making eventual code analysis possible. Most relevantly, JACOB has been successfully applied to uncover unwanted user tracking and fingerprinting in e-commerce websites operated by a well-known Chinese company.

关键词： javascript web cybercrime code obfuscation code deobfuscation ccontrol flow flattening reverse engineering e-commerce user tracking fingerprinting

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：